GeoScan Privacy Policy

II. Data controller

The controller of your personal data is GEOIMPACT VENTURES SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ with its registered office in Lublin, at ul. Kowalskiej 5/203, 20-115 Lublin, entered into the Register of Entrepreneurs of the National Court Register under KRS number: 0001154522, holding NIP (tax identification number): 7162846759, REGON (national business registry number): 540856639 (hereinafter: the „Controller” or the „Company”).

The Controller can be contacted on matters relating to the protection of personal data by e-mail at: contact@geoscan-app.com or in writing to the Company's registered office address.

III. Definitions

• GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
• User – any natural person visiting the Service or using one or more of the services or functionalities described in the Policy.
• Account – an individual panel available to the User after registering on the Service, enabling the use of GeoScan's services.
• Personal data – information about an identified or identifiable natural person.

IV. Purposes and legal bases for processing data

The Controller processes your personal data for the following purposes and on the basis of the following legal grounds:

Provision of electronic services

• Purpose: Enabling registration, login, and use of the full functionality of the platform (generating reports, spatial analyses).
• Legal basis: Necessity for the performance of the agreement for the provision of electronic services (Art. 6(1)(b) GDPR).

Handling orders and payments

• Purpose: Processing the purchase of subscriptions or report packages, and one-off reports.
• Legal basis: Necessity for the performance of the agreement (Art. 6(1)(b) GDPR).

Fulfilling legal obligations (accounting)

• Purpose: Issuing and storing invoices and accounting documents.
• Legal basis: Fulfilment of a legal obligation incumbent on the Controller, e.g. tax regulations (Art. 6(1)(c) GDPR).

Contact and handling of inquiries

• Purpose: Responding to questions submitted via the contact form, e-mail, or chat.
• Legal basis: The Controller's legitimate interest in building relationships with Users and handling inquiries (Art. 6(1)(f) GDPR).

Direct marketing and newsletter

• Purpose: Sending commercial information about new features, product updates, and promotions.
• Legal basis: The User's consent (Art. 6(1)(a) GDPR) or the Controller's legitimate interest in the case of marketing its own services (Art. 6(1)(f) GDPR).

Analytics, statistics, and security

• Purpose: Analysing traffic on the site, detecting abuse, improving the quality of the services.
• Legal basis: The Controller's legitimate interest (Art. 6(1)(f) GDPR).

V. Recipients of personal data

Your data may be shared with entities that support us in conducting our business („Processors”), solely on the basis of concluded data processing agreements. These include:

• Hosting and server providers (cloud data storage).
• Electronic payment operators (for processing transactions).
• Accounting offices and accounting firms.
• Analytics and marketing tool providers (Google, mailing systems).
• AI model providers (Google Cloud, Vertex AI) — solely for the assistant that answers questions about a report and writes its summary; report data is not used to train models.
• IT support and customer service software providers.

VI. Transfer of data outside the EEA

Due to the use of services from providers such as Google or Microsoft, your data may be transferred outside the European Economic Area (EEA). The Controller ensures that any such transfer is based on appropriate legal safeguards, such as:

• European Commission adequacy decisions.
• Standard Contractual Clauses (SCC) approved by the European Commission.
• The Data Privacy Framework for transfers to the USA.

VII. Data retention period

We store your data for the period necessary to achieve the purposes for which it was collected:

• Data related to the performance of the agreement (Account/Orders): for the duration of the agreement, and after its termination until any claims become time-barred (usually 3 or 6 years).
• Accounting data: for 5 years from the end of the calendar year in which the tax payment deadline fell (a statutory requirement).
• Data processed on the basis of consent (e.g. newsletter): until the consent is withdrawn.
• Analytical data: until an effective objection is raised or the data becomes outdated.

VIII. Users' rights

Under the GDPR, you have the following rights:

• Right of access to data – you have the right to obtain information as to whether we process your data, and to obtain a copy of it.
• Right to rectification of data – if your data is incorrect or incomplete.
• Right to erasure of data (the „right to be forgotten”) – in cases provided for by the GDPR (e.g. when the data is no longer necessary for the purposes for which it was collected).
• Right to restriction of processing.
• Right to data portability.
• Right to object – to processing of data based on the Controller's legitimate interest (e.g. for marketing purposes).
• Right to withdraw consent – at any time, without affecting the lawfulness of processing carried out before its withdrawal.

To exercise your rights, please contact us at: contact@geoscan-app.com. You also have the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw), if you consider that the processing infringes the GDPR.

IX. Cookies and tracking technologies

The Service uses cookies, i.e. small pieces of text information stored on the User's end device.

We use cookies for the following purposes:

• Necessary: Maintaining the User's session after logging in, ensuring security.
• Analytical: Studying traffic statistics on the Service (Google Analytics, PostHog), including analysis of user behaviour, session recordings, and heat maps, which helps us improve the functionality and usability of the Service.
• Marketing: The ability to tailor advertising content.

The User can change their cookie settings at any time in their web browser or via the consent management panel available on the site. Disabling necessary cookies may affect the correct functioning of certain features of the Service (e.g. logging in).

X. Changes to the Privacy Policy

The Controller reserves the right to make changes to this Privacy Policy, which may result from the development of internet technology, changes in data protection law, or the development of the Service.

Users will be informed of any changes in a visible and understandable manner (e.g. via a notice on the Service or an e-mail message for registered Users).

The current version of the Policy is always available at www.geoscan-app.com.